/apollo-mcp-server

name: apollo-mcp-server
description: >
  Guide for using Apollo MCP Server to connect AI agents with GraphQL APIs.
  Use this skill when: (1) setting up or configuring Apollo MCP Server,
  (2) defining MCP tools from GraphQL operations, (3) using introspection
  tools (introspect, search, validate, execute, explorer), (4) configuring
  authentication, CORS, health checks, or telemetry, (5) writing Rhai
  scripts for request lifecycle hooks, (6) defining MCP prompts,
  (7) troubleshooting MCP server connectivity or tool execution issues,
  (8) building MCP Apps for interactive UI experiences,
  (9) deploying Apollo MCP Server to production.
license: MIT
compatibility: Works with Claude Code, Claude Desktop, Cursor.
metadata:
  author: apollographql
  version: "1.3.0"
allowed-tools: Bash(rover:*) Bash(npx:*) Read Write Edit Glob Grep

Apollo MCP Server Guide

Apollo MCP Server exposes GraphQL operations as MCP tools, enabling AI agents to interact with GraphQL APIs through the Model Context Protocol.

Quick Start

Step 1: Install

# Linux / MacOS
curl -sSL https://mcp.apollo.dev/download/nix/latest | sh

# Windows
iwr 'https://mcp.apollo.dev/download/win/latest' | iex

Step 2: Configure

Create `config.yaml` in your project root:

transport:
  type: streamable_http
schema:
  source: local
  path: ./schema.graphql
operations:
  source: local
  paths:
    - ./operations/
introspection:
  introspect:
    enabled: true
  search:
    enabled: true
  validate:
    enabled: true
  execute:
    enabled: true

Start the server:

apollo-mcp-server ./config.yaml

The MCP endpoint is available at `http://127.0.0.1:8000/mcp` (streamable_http defaults: address `127.0.0.1`, port `8000`). The GraphQL endpoint defaults to `http://localhost:4000/` — override with the `endpoint` key if your API runs elsewhere.

The server watches the config file for changes and automatically restarts with updated configuration.

Step 3: Connect

Add to your MCP client configuration:

**Streamable HTTP (recommended):**

Claude Desktop (`claude_desktop_config.json`):

{
  "mcpServers": {
    "graphql-api": {
      "command": "npx",
      "args": ["mcp-remote", "http://127.0.0.1:8000/mcp"]
    }
  }
}

Claude Code:

claude mcp add graphql-api -- npx mcp-remote http://127.0.0.1:8000/mcp

**Stdio (client launches the server directly):**

{
  "mcpServers": {
    "graphql-api": {
      "command": "./apollo-mcp-server",
      "args": ["./config.yaml"]
    }
  }
}

Built-in Tools

| Tool | Purpose | When to Use | |------|---------|-------------| | `introspect` | Explore schema types in detail | Need type definitions, fields, relationships | | `search` | Find types in schema | Looking for specific types or fields | | `validate` | Check operation validity | Before executing operations | | `execute` | Run ad-hoc GraphQL operations | Testing or one-off queries | | `explorer` | Open operation in Apollo Explorer | Generate Explorer URLs (requires GraphOS graph ref) |

Defining Custom Tools

MCP tools are created from GraphQL operations:

1. Operation Files (Recommended)

operations:
  source: local
  paths:
    - ./operations/

2. Operation Collections

operations:
  source: collection
  id: your-collection-id

3. Persisted Queries

operations:
  source: manifest
  path: ./persisted-query-manifest.json

4. Schema Introspection

operations:
  source: introspect

5. GraphOS Uplink

operations:
  source: uplink

Reference Files

• [Tools](references/tools.md) - Introspection tools, explorer, minify notation, tool annotations
• [Configuration](references/configuration.md) - All configuration options including tasks and caching
• [Authentication](references/auth.md) - OAuth 2.1, scopes, token validation, rate limiting, per-operation scopes
• [Rhai Scripting](references/rhai-scripting.md) - Lifecycle hooks and built-in functions
• [MCP Prompts](references/prompts.md) - Reusable prompt templates
• [MCP Apps](references/mcp-apps.md) - Interactive mini-applications for MCP-compatible hosts
• [Deployment](references/deploy.md) - Docker, Kubernetes, Apollo Runtime Container, scaling
• [Error Handling](references/error-handling.md) - Protocol errors, tool errors, GraphQL error mapping
• [Best Practices](references/best-practices.md) - Security guidance, mutation gating, tool poisoning, token passthrough
• [Telemetry](references/telemetry.md) - OpenTelemetry metrics, traces, and dashboards
• [Troubleshooting](references/troubleshooting.md) - Common issues and solutions

Key Rules

Security

> **Security: Sensitive operations.** Configure authentication before exposing to AI agents. Use `headers` for API keys, OAuth for user-scoped access.

• Disable introspection tools in production (they are disabled by default)
• Use `overrides.mutation_mode` to control mutation exposure

Authentication

# Static header
headers:
  Authorization: "Bearer ${env.API_TOKEN}"

# Dynamic header forwarding
forward_headers:
  - x-tenant-id

# OAuth (streamable_http transport)
transport:
  type: streamable_http
  auth:
    servers:
      - https://auth.example.com
    audiences:
      - https://api.example.com
    scopes:
      - read
    scope_mode: require_all

Schema Sources

# Local file
schema:
  source: local
  path: ./schema.graphql

# Federated graphs (uplink)
schema:
  source: uplink

# Non-federated graphs (graphos)
schema:
  source: graphos

Mutations

Control mutation behavior via `overrides.mutation_mode`:

| Mode | Predefined mutations | Ad hoc mutations (`execute`) | |------|---------------------|------------------------------| | `none` | Skipped | Rejected | | `explicit` | Exposed | Rejected | | `all` | Exposed | Allowed |

MCP Apps

Build interactive UI experiences inside MCP Apps-compatible hosts (e.g., ChatGPT). Define tools wit